{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:594aa44f-1ce4-52d8-abd3-33b0350f46de", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "type": "library", "group": "laravel", "bom-ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare", "version": "5.8.38-p7+tuxcare", "pedigree": { "ancestors": [ { "name": "framework", "purl": "pkg:composer/laravel/framework@5.8.38", "type": "library", "group": "laravel", "version": "5.8.38" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "AIKIDO-2026-10659", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:5211e13a-09c3-5aad-89d5-0db905a4eca5", "analysis": { "state": "resolved", "detail": "Vulnerability AIKIDO-2026-10659 is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2019-9081", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:ceac8c61-331c-57f5-b488-7d7a72902c7a", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2019-9081 is a false positive for laravel/framework 5.8.38-p7+tuxcare. CVE-2019-9081 REJECTED by its CNA on 2022-08-19 (cve.org: withdrawn, not a security issue). No fix shipped or needed; PendingCommand.php is identical to upstream in every tuxcare release (checked 2026-10-19)." } }, { "id": "CVE-2020-24941", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:8b1ad50c-ca22-5923-bae4-d52154ab3210", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-24941 is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2021-43617", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:13a474cb-bd46-5aad-a75e-8c3c4e6ac4c1", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2021-43617 is a false positive for laravel/framework 5.8.38-p7+tuxcare." } }, { "id": "CVE-2021-43808", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:6fd2efe6-4fb1-57b4-aa38-80e5853aeea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-43808 is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2024-52301", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:d6a66b85-5e59-51e4-8251-0c19d50f0546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-52301 is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2025-27515", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:e5e3df2b-141c-5cd7-98d0-1b77703ead3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27515 is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "CVE-2026-102279", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:4e0b9891-53fd-52d0-b1be-b9233af29d45", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-102279 does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38 is NOT AFFECTED by CVE-2026-102279. The vulnerability requires a Tippy.js tooltip renderer with allowHTML:true that was introduced in Laravel 12.x's custom exception renderer. Laravel 5.8.38 uses a completely different architecture (Whoops library or Symfony's exception handler) with no JavaScript-based tooltip rendering. The vulnerable component (src/Illuminate/Foundation/resour...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-114509", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:148dd36c-a8f6-59a2-90a3-c793f12c9dc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-114509 affects version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "GHSA-4mg9-vhxq-vm7j", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:5c1743b3-6a66-51d1-bd41-993ef4c493bd", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-4mg9-vhxq-vm7j is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "GHSA-5vg9-5847-vvmq", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:c6fcbba9-a627-58e9-979c-68e8c4fb9213", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-5vg9-5847-vvmq is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "GHSA-crmm-hgp2-wgrp", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:038375a7-d860-5e8b-8083-03271be161fa", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-crmm-hgp2-wgrp does not affect version 5.8.38-p7+tuxcare of laravel/framework. not_affected \u2014 Laravel 5.8.38-p4+tuxcare is not affected by GHSA-crmm-hgp2-wgrp. The vulnerability affects LocalFilesystemAdapter's temporary signed URL functionality, which does not exist in Laravel 5.8. This feature was introduced in Laravel 11+. The target version only supports temporary URLs for cloud storage (S3/Rackspace), which use different mechanisms that are not vulnerable to this path encoding issue.", "justification": "code_not_present" } }, { "id": "GHSA-qm5c-m76r-2hfr", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:fbde22d1-3e71-573a-89e4-292d0da6ab06", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-qm5c-m76r-2hfr is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } }, { "id": "GHSA-x7p5-p2c9-phvg", "affects": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ], "bom-ref": "urn:uuid:73e9a1e6-22d6-54f6-b1a5-6cf6fbb5e22c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-x7p5-p2c9-phvg is fixed in version 5.8.38-p7+tuxcare of laravel/framework." } } ], "dependencies": [ { "ref": "pkg:composer/laravel/framework@5.8.38-p7+tuxcare" } ] }